You could look at the url and body properties on the corresponding HTTPRequestMessage and reconstruct the URL (assuming method="GET"). You can get this message from either the asynchronous completion token returned from calling httpService.send(), or via an InvokeEvent's message property by registering an invoke="invokeHandler(event)" listener on <mx:HTTPService>.

If you're not using a server side gateway / proxy, the client-side mx.messaging.channels.DirectHTTPChannel is the class that manages the HTTP request. It sets up the query parameters to append to the url in its mx_internal::createURLRequest() method around line 234: